4.4.2.4 Establishment of an EPS security context during inter-system change from N1 mode to S1 mode in 5GMM-CONNECTED mode

In order for the UE operating in single-registration mode in a network supporting N26 interface to derive a mapped EPS security context for an inter-system change from N1 mode to S1 mode in 5GMM-CONNECTED mode, the AMF shall prepare a mapped EPS security context for the target MME as indicated in 3GPP TS 33.501 [24].

The AMF shall derive a K'ASME using the KAMF key and the downlink NAS COUNT of the current 5G NAS security context, include the corresponding NAS sequence number in the N1 mode to S1 mode NAS transparent container IE (see clause 9.11.2.7) and then increments its stored downlink NAS COUNT value by one.

NOTE: The creation of the N1 mode to S1 mode NAS transparent container and the increment of the stored downlink NAS COUNT value by one are performed in prior to transferring the mapped EPS security context to the MME.

The AMF shall select the NAS algorithms identifiers to be used in the target MME after the inter-system change from N1 mode to S1 mode in 5GMM-CONNECTED mode, for encryption and integrity protection. The uplink and downlink NAS COUNT associated with the newly derived K'ASME key are set to the uplink and downlink NAS COUNT value of the current 5G NAS security context, respectively. The eKSI for the newly derived K'ASME key shall be defined such as the value field is taken from the ngKSI and the type field is set to indicate a mapped security context.

When the UE operating in single-registration mode in a network supporting N26 interface receives a command to perform inter-system change from N1 mode to S1 mode in 5GMM-CONNECTED mode, the UE shall derive the mapped EPS security context, i.e. derive K'ASME from KAMF using a downlink NAS COUNT based on the NAS sequence number received in the N1 mode to S1 mode NAS transparent container IE (see clause 9.11.2.7) as described in 3GPP TS 33.501 [24]. The UE shall set the uplink and downlink NAS COUNT values associated with the newly derived K'ASME key to the uplink and downlink NAS COUNT values of the current 5G NAS security context respectively. The eKSI for the newly derived K'ASME key is defined such that the value field is taken from the ngKSI and the type field is set to indicate a mapped security context. The UE shall also derive the NAS keys as specified in 3GPP TS 33.401 [23A] using the EPS NAS security algorithms identifiers that are stored in the UE's 5G NAS security context.

If the received N1 mode to S1 mode NAS transparent container IE does not have a valid NAS COUNT (see clause 4.4.3.2) the UE shall discard the content of the received N1 mode to S1 mode NAS transparent container IE and inform the lower layers that the received N1 mode to S1 mode NAS transparent container is invalid.

If the inter-system change from N1 mode to S1 mode in 5GMM-CONNECTED mode is not completed successfully, the AMF and the UE shall delete the new mapped EPS security context.